Warning signs that someone may be spying on your phone through stalkerware include unusually fast battery drain, a phone that feels warm when you're not actively using it, higher-than-expected data usage, unfamiliar apps or permissions, and someone knowing personal details or your whereabouts that they shouldn't have any way of knowing. No single sign confirms it on its own — batteries degrade naturally, and phones run warm for plenty of ordinary reasons — but a cluster of these signs together, especially alongside someone's uncanny knowledge of things you didn't tell them, is worth taking seriously.
This is a topic that deserves a different tone than most tech troubleshooting content, and we want to be upfront about that. Stalkerware isn't just a technical nuisance like adware or a slow computer — it's frequently a tool used in situations involving control, surveillance, and sometimes domestic abuse. We've written this guide to be practical and clear without being alarmist, and to take the personal safety dimension seriously rather than treating this purely as a device-cleanup problem. If you take away one thing before reading further, let it be this: if you suspect you're in an unsafe relationship or situation, please read the safety note before you act on anything else in this article.
Who wrote this guide
This article was written and reviewed by IT Cares certified technicians. We've helped clients quietly and discreetly check devices they suspected were being monitored, and we've learned that the technical side — finding and removing an app — is often the easier half of the problem. The harder half is doing it safely, which is why this guide treats that question with the weight it deserves rather than rushing straight to a removal checklist.
What Stalkerware Actually Is
Stalkerware refers to commercially available apps — frequently marketed as "parental control" or "employee monitoring" software — that get repurposed to secretly track a partner, family member, or another adult without their knowledge or genuine consent. These apps can read text messages, log call history, track real-time GPS location, monitor browsing activity, and in more invasive cases access the camera or microphone, all while running hidden or disguised as an innocuous system app.
What sets stalkerware apart from typical malware is how it usually gets there in the first place. Most malware is installed remotely by an attacker with no personal connection to the victim, often through a malicious link, download, or software vulnerability, aimed at stealing data or money broadly across many potential targets. Stalkerware is different: it's most commonly installed by someone with existing physical access to the device — a partner, family member, or employer — and an existing personal relationship with the person being monitored. That distinction matters both technically (it explains why stalkerware often bypasses defenses aimed at remote attackers) and practically, since it means the person responsible is frequently someone the victim knows, trusts, or lives with.
📊 IT Cares field note: The commercial monitoring apps behind most stalkerware cases are legal to sell and are genuinely marketed for legitimate uses — a parent monitoring a young child's first phone, for instance. The technology itself isn't automatically the problem; it's the context of secret, non-consensual use against an adult partner or family member that turns a legal product into stalkerware.
Security researchers sometimes call this category "dual-use" software for exactly this reason — the same app can be a legitimate parental control tool in one household and a tool of covert surveillance in another, with the only real difference being consent and disclosure rather than anything technical about the app itself. This is also why stalkerware occupies an awkward space compared to more clear-cut malware: app stores and security vendors can't simply ban the underlying technology outright, since a genuine market exists for monitoring a young child's device or a company-owned phone with proper disclosure. What they can and increasingly do flag is the covert, hidden installation pattern itself — an app running with a disguised name, hidden from the app drawer, and granted permissions far beyond what its stated purpose would require.
Would rather have a professional check your device discreetly?
Our certified technicians can look at your phone or computer remotely and tell you plainly what's actually there — handled privately, no judgment.
12 Warning Signs Worth Paying Attention To
These signs each have innocent explanations on their own — that's important to keep in mind so this doesn't turn into constant anxiety over a normally aging battery. What matters more is whether several of these show up together, especially alongside a pattern of someone knowing things about you they shouldn't.
1. Battery draining unusually fast
Monitoring software typically runs continuously in the background, logging activity and periodically transmitting it, which consumes meaningfully more battery than normal use. If your phone suddenly needs charging far more often than it used to, and you haven't added any new apps or changed your usage habits, it's worth a closer look.
2. The phone running warm when you're not using it
A phone that feels warm while actively streaming video or navigating is normal. A phone that feels warm sitting untouched in your pocket or on a table is a different signal — it suggests something is actively working in the background even while the device appears idle.
3. Increased data usage
Stalkerware needs to transmit the information it collects somewhere, and that transmission uses mobile data or Wi-Fi. Check Settings for data usage by app, and look for anything consuming a noticeable amount that you can't attribute to an app you actually use.
4. Unfamiliar apps or unusual app permissions
Go beyond your home screen and check your complete list of installed apps — stalkerware is often hidden from the home screen or disguised with a generic, innocuous name and icon (something like "System Update" or "Device Health"). Also check which apps have been granted permissions like location, microphone, camera, or SMS access that seem excessive for what the app claims to do.
5. The phone taking longer to shut down or restart
Monitoring software often needs to finish transmitting data or reinitialize its background processes during shutdown and restart, which can noticeably slow down what should be a near-instant action.
6. The screen activating on its own
A screen lighting up when the phone is sitting untouched, without a notification visibly appearing, can indicate a background process waking the device to capture information or transmit data.
7. Unusual sounds or delays during phone calls
Faint clicking, echoing, or a brief delay at the start of calls can, in some cases, indicate call recording or interception, though this is also frequently just a normal network or carrier issue — it's a weaker signal on its own than the others on this list, but worth noting alongside other signs.
8. Someone knowing information they shouldn't have access to
This is often the most reliable indicator of all, because it doesn't depend on any technical detection at all. If someone repeatedly seems to know where you were, who you spoke with, or the specifics of a private conversation or message without you having told them, that pattern is a stronger signal than any battery or data anomaly.
9. Android "install from unknown sources" enabled without your knowledge
Most stalkerware for Android isn't distributed through the Google Play Store — it's sideloaded directly, which requires enabling "install from unknown sources" in settings. If you find this setting turned on and you don't remember enabling it yourself, that's a meaningful red flag.
10. An unfamiliar configuration profile or MDM entry on iPhone
Check Settings > General > VPN & Device Management for any configuration profile you don't recognize installing. Some stalkerware on iOS operates through mobile device management (MDM) profiles typically intended for company-managed devices — finding one you didn't set up yourself on a personal phone is a serious warning sign.
11. Unusual browser activity or a changed default browser
Some monitoring tools redirect browsing through a proxy to log activity, which can show up as a changed default browser, unfamiliar bookmarks, or a browser history that doesn't match your actual usage.
12. Location services behaving strangely
A location icon appearing in your status bar when you don't believe any app should currently need your location, or a "location services recently used" list in settings showing an app you don't recognize or don't remember granting access to, both warrant a closer look.
How Stalkerware Differs by Platform
iOS and Android are not equally vulnerable to stalkerware, and understanding why matters both for assessing your own risk and for knowing what to check.
| Factor | iOS (iPhone) | Android |
|---|---|---|
| Typical install method | Requires either jailbreaking the device or physical access plus your passcode, often via a configuration profile | Can be sideloaded directly with physical access alone, without jailbreaking or rooting required |
| App store restrictions | Apple's App Store review process blocks most overt stalkerware apps from official distribution | Google Play has strengthened policies, but sideloading outside the Play Store bypasses this entirely |
| Barrier to install | Higher — needs your unlock code and enough time with the device to configure it | Lower — a few minutes of physical access is often sufficient with settings enabled |
| Where to check first | Settings > General > VPN & Device Management for unfamiliar profiles | Settings > Apps (full list) and Settings > Security > Device admin apps |
The practical takeaway: iOS is meaningfully harder to compromise this way, which is a genuinely reassuring data point if you use an iPhone — but "harder" is not "impossible," particularly if someone else knows your passcode and has had unsupervised time with the device. Android's more open app-installation model makes it more exposed by default, which is precisely why checking the "unknown sources" setting and the full app list matters more on Android than almost any other single check.
Common Misconceptions About Stalkerware
"If my phone is clean today, it'll stay that way"
Not necessarily, if the person you suspect still has regular physical access to your device — a factory reset or a manual removal only solves the problem until the next time they have a few unsupervised minutes with your phone. If ongoing physical access is part of your situation, a one-time cleanup may need to be paired with a broader change, like a new passcode the other person doesn't know, or in some cases a new device altogether.
"Stalkerware always causes obvious battery drain"
Not always. Better-built commercial monitoring apps are specifically optimized to minimize battery and data footprint precisely so they're harder to notice, which means a phone behaving completely normally doesn't fully rule stalkerware out. Battery and data anomalies are a strong signal when present, but their absence isn't proof of a clean device — it's part of why checking installed apps and permissions directly still matters even when nothing "feels" wrong.
"Only romantic partners install stalkerware"
Romantic and former partners are the most commonly discussed case, but stalkerware shows up in other relationships too — a parent monitoring an adult child without their knowledge, an employer monitoring a personal device that was never meant to be company-managed, or a family member monitoring another adult in the household. The detection and removal process is the same regardless of who is on the other end; only the safety planning around a potentially abusive dynamic changes based on the specific relationship and risk involved.
"A factory reset means losing everything permanently"
A factory reset does erase the device, but it doesn't have to mean losing your photos, contacts, or messages — those can be backed up separately from your apps and restored afterward. What you specifically want to avoid restoring is a full app backup taken while the stalkerware was still installed, since that can silently reinstall it along with everything else. Backing up personal files only, then setting the phone up as new rather than restoring from a full backup, gets you a clean device without losing what actually matters to you.
Investigating Safely Without Alerting Anyone
If you're in the early stage of figuring out whether something is actually installed — before you've decided on removal or a safety plan — how you investigate matters almost as much as what you find. A few practical habits reduce the chance of tipping anyone off while you're still gathering information.
- Do your research from a different device. Searching "how do I know if my phone has spyware" on the phone you suspect is compromised can itself be visible to whoever is monitoring it. Use a friend's phone, a work computer, or a library computer for the reading and research part of this process.
- Avoid discussing your suspicions over text or call on the suspected device. If someone is monitoring messages and calls, telling a friend "I think my ex put something on my phone" over that same phone defeats the purpose of investigating quietly.
- Don't confront the person before you have a plan. Confirming your suspicion out loud before you've decided how you want to handle it — safely, on your own timeline — removes your ability to choose the moment and method that works best for your situation.
- Take your time on the decision, even if the discovery feels urgent. Finding stalkerware is unsettling, but rushing straight to removal without a plan is exactly the scenario the safety note above is warning against. A day or two of careful planning rarely makes the situation meaningfully worse, and it can make the response meaningfully safer.
Important Safety Note — Please Read Before Removing Anything
If you believe you may be in an unsafe or abusive situation, read this first
Removing stalkerware can immediately alert the person monitoring you that you know it's there — many of these apps stop transmitting data the moment they're uninstalled, and someone actively watching that data may notice right away. If there is any chance you are in an abusive relationship or an unsafe situation, removing the app before you have a safety plan in place can escalate risk rather than reduce it.
In that specific situation, please consider reaching out to your national or local domestic violence hotline first — they specialize in exactly this scenario and can help you build a safety plan around the timing and method of removal, or advise you to leave the app in place temporarily while you take other precautions. This isn't about discouraging you from acting; it's about acting in the order that keeps you safest.
If your situation doesn't involve a safety concern — for example, you're checking a personal device, a work phone, or a family member's device with their knowledge and consent — the removal steps below can be followed directly without this added layer of caution. The distinction matters enough that we wanted to state it plainly rather than bury it at the end of the article.
How to Check For and Remove Stalkerware
These steps assume safety isn't an active concern in your situation. If it is, please revisit the note above before proceeding.
Check installed apps and device admin/profile permissions
Go through your full app list, not just the home screen. On Android, check Settings > Security > Device admin apps for anything you didn't authorize. On iOS, check Settings > General > VPN & Device Management for any configuration profile you don't recognize.
Look for unusual battery and data usage
Check Settings > Battery and Settings > Data usage for any app consuming unusually high resources in the background, especially one with a generic or unfamiliar name.
Run a reputable mobile security scanner
A well-reviewed mobile security app can detect many known stalkerware signatures, though some well-disguised tools can still slip past scanning — treat a clean scan as reassuring, not definitive.
Factory reset as the most reliable removal method
A full factory reset, after backing up only personal files you're confident are safe (photos, contacts — not a full app backup), remains the most reliable way to guarantee stalkerware is gone, since it wipes every installed app and system-level configuration at once.
Change all account passwords from a different, clean device
After the reset, change passwords for email, banking, and social accounts from a separate device that was never compromised, since stalkerware may have already captured credentials before you removed it.
Re-enable app store protections
On Android, make sure "install from unknown sources" is switched back off once you're done. On iOS, avoid installing any configuration profile you don't fully understand going forward.
Why a factory reset beats trying to find and delete the app manually
Well-disguised stalkerware can be difficult to identify with certainty just by browsing your app list — a generic name and icon can look identical to a legitimate system component. A factory reset sidesteps that identification problem entirely by wiping everything and starting clean, which is why it's the most reliable single step in this whole process, even though it's more disruptive than deleting one specific app.
If you'd rather not go through this alone, or you're not confident interpreting what you find, our is my computer hacked warning signs guide covers the equivalent process for a computer, and IT Cares can also check a device remotely and discreetly if you'd prefer a professional look rather than working through it solo. There's no requirement to handle this entirely by yourself — a second, technically trained set of eyes can often confirm in minutes what might otherwise take hours of uncertain manual checking, and it removes the guesswork of wondering whether you looked in the right places.
Frequently Asked Questions
Would Rather Have a Professional Check Your Device Discreetly?
If you're not confident going through this alone, IT Cares can check your phone or computer remotely and give you a straight, private answer about what's actually on it.
Comments (3)
Really appreciated that this didn't just jump straight to "delete it now." The safety note before the removal steps matters more than people realize.
Didn't realize the iOS vs Android difference was this significant. Explains why my old Android phone felt so much easier to "manage" for my previous employer.
Checked device admin apps on my Android after reading this and found one I genuinely didn't remember installing. Turned out to be old software from a previous phone plan, but glad I checked.
Leave a Comment